1. Measuring Net Neutrality Alex Maltinsky Prof. Ran Giladi

2. Agenda What is net neutrality? 1 The problem 2 Neutrality violations 3 Research Goal 4 Existing Solutions 5

3. What is net neutrality?  A tricky, debatable definition  Essentially: “All bits are created equal” Absolute neutrality –First come first served –No QoS Limited Discrimination without QoS tiering –QoS Differentiation is allowed as long as you can’t pay for a higher grade service Limited discrimination and tiering –Same payment -> same QoS treatment

4. The Problem  Internet traffic increases due to services that didn’t exist before  P2P (Bit-Torrent, Gnutella, etc..) Up to 70% (!) of internet traffic  Streaming Media Accounts for approx 10% of internet traffic YouTube streams approx 1 Petabyte EVERY DAY.  Online Games About 5% of online traffic *http://www.ipoque.com/resources/internet-studies/internet-study-2008_2009 *Philipp Svoboda, Wolfgang Karner, Markus Rupp,“Traffic Analysis and Modeling for World of Warcraft”, ICC 2007

5. The Problem *http://www.ipoque.com/resources/internet-studies/internet-study-2008_2009

6. The Problem  Internet traffic increases *http://www.cisco.com/go/vni

7. The Problem  Broadband providers claim running a neutral network isn’t profitable and they have no incentive to build new networks  They offer to roll the rising costs on both the consumers and the large content providers (e.g. YouTube).  Legislation is very tricky because service providers need tools to manage their networks and deal with attacks, spam. It’s hard to draw the line.

8. The Problem  Legislators are not very tech-savvy  “And again, the Internet is not something that you just dump something on. It's not a big truck. It's a series of tubes.” – Senator Ted Stevens  To this day, there is little legislation on the matter.  ISPs exploit the ambiguity in the law and employ various means of reducing costs

9. Neutrality Violations  Comcast, the second largest ISP in the U.S injected forged TCP RST packets into Bit-Torrent sessions.  Injections occurred when Comcast subscribers uploaded data to peers outsize the ISP.  The injections took place well after the handshake, and often after some data has been exchanged to prevent detection.

10. Neutrality Violations  Comcast was sued and investigated.  In Dec 2009 they agreed to pay 16,000,000$ to settle the lawsuit without admitting to any wrongdoing.  Comcast used equipment from Canadian vendor Sandvine to perform the injections.  Many other companies specialize in selling ISPs DPI equipment for such purposes.  BlueCoat  Arbor Networks  Allot Communications

11. Neutrality Violations  T-Mobile, a German mobile telephone provider, owned by Deutsche Telekom completely blocked Skype in its network.  Cellcom, in Israel, did the same thing.

12. Neutrality Violations  Some ISPs block incoming traffic to some well- known ports including port 80 to prevent users from running servers.  To unblock the port, the customer has to pay extra for a “Business” package.

13. Neutrality Violations  Some ISPs track Bit-Torrent traffic and create internal caching servers to save on outbound traffic

14. Research Goal  A tool for detecting neutrality violations in networks  To be used by experts and end users  Identify and pinpoint location and nature of the violation  Suggest methods for bypassing the network policy

15. Existing Solutions  Glasnost  Max Planck Institute for Software Systems  Active data injection using a Java applet Glasnost: Enabling End Users to Detect Traffic Differentiation. Marcel Dischinger, Massimiliano Marcon, Saikat Guha, Krishna P.Gummadi, Ratul Mahajan, and Stefan Saroiu Proceedings of the 7th Usenix Symposium on Networked Systems Designand Implementation (NSDI), San Jose, CA, April 2010.

16. Existing Solutions  Glasnost  Two flows are sent back to back. A flow with appropriate “triggers” such as port numbers and payload. A reference flow with the same properties but without the triggers

17. Existing Solutions  Glasnost  Throughput of both flows is measured and compared  Only tests with low or occasional noise are taken into account x marks the median

18. Existing Solutions  Glasnost  Differentiation is detected when the maximum throughput of a certain flow differs by more than  from the maximum of the other flow  368,851 Users used Glasnost Between Mar 08 and Sept 09

19. Existing Solutions  Top 30 ISPs, ranked based on fraction of hosts that detected differentiation during Jan - Feb 09:

20. Existing Solutions  Glasnost’s Shortcomings  Does not detect particular differentiation mechanisms, measures only performance. Therefore can’t PROVE the existence of a violation.  Throughput is (currently) the only measure of performance  Noise can affect results – two back to back flows can be VERY different.  Aimed at end users, provides little technical data.

21. Existing Solutions  Glasnost’s Shortcomings  Test is very short and  very large (50%) because of user impatience.  Checks only for protocol (L5/L4) based differentiation. What if an ISP limits the number of connections? What if an ISP differentiates based on: –Destination address –Message pattern / timing –Tracker Communication  Java applets have limited permissions. Glasnost has no access to the raw socket on the client side. Abnormal behavior below the app. Layer will be missed

22. Existing Solutions  NANO: Network Access Neutrality Observatory  Georgia Tech  “Black Box” approach, uses statistical analysis  Passive Data collection  Protocol independent  Dedifferentiation technique independent Detecting Network Neutrality Violations using Causal Inference. Mukarram Bin Tariq, Murtaza Motiwala, Nick Feamster, Mostafa Ammar ACM CoNext 2009

23. Existing Solutions  NANO: Network Access Neutrality Observatory  Tries to estimate for each ISP and service Gx – performance of the service with a given X. X is either 1 or 0. –1: We access the service through the ISP –0: We don’t access the service through the ISP  Estimating using association ( ) is not good enough since most sample sets are ONLY with X=1 for some ISP and X=0 for the others.

24. Existing Solutions  NANO: Network Access Neutrality Observatory  Estimation is performed using association by adjusting for confounding variables Location Time of day Client OS  Statistics are calculated for users that: Access the same service Have similar values for the confounding variables Use different ISPs.  Statistics of ISPs are compared to a baseline of the “average” ISP.

25. Existing Solutions  - causal effect of a service j when accessed through ISP I  Z – Set of confounding variables  B(s) – Range of values of confounding variables in the stratum  -causal effect within the stratum  -probability of service j under stratum s with ISP i. -

26. Existing Solutions  NANO: Network Access Neutrality Observatory  Throughput and latency data is collected from client agents. Throughput is estimated by counting uploaded/downloaded bytes. Latency is estimated by measuring the latency between the SYN and SYN/ACK packets in a TCP session. The agent also collects data on connection duration, and events such as losses, timeouts and unexpected terminations (TCP RST…)

27. Existing Solutions  NANO’s Shortcomings  Does not detect particular differentiation mechanisms, measures only performance. Therefore can’t PROVE the existence of a violation.  No immediate feedback Results are computed on the main server and published from time to time  An “average” ISP is used as a baseline, so if differentiation is the norm, it won’t be detected.

28. Existing Solutions  NANO’s Shortcomings  Latency estimation using delay between SYN and SYN ACK is poor.  The platform depends on passive packet gathering NANO is not in control over the traffic which is a critical variable.